virustotal.com

Observed Jul 21, 2026, 19:16 UTC (2d ago). Every field below was attested with an Ed25519 signature at scan time. Catalog observation, re-checked on rotation — watch it for 5-minute checks.

Verify this receipt yourself + Watch this domain

Up right now

Runs onGoogle

Email byGoogle Workspace

Secured byGoogle Trust Services

Registered withMarkMonitor Inc.

Also usesHubSpotGoogle Search Console

IPv6 · cybersecurity_expanded

Every line above is a signed observation. Check the math at the bottom of the page.

INFRASTRUCTURE MAPwhat virustotal.com actually stands on - every host below is a signed observation

virustotal.com

A / AAAA

216.239.38.21216.239.36.21216.239.34.21216.239.32.21+4 more

Googleserves the site

ns-cloud-c4.googledomains.comns-cloud-c2.googledomains.comns-cloud-c3.googledomains.comns-cloud-c1.googledomains.com

googledomains.comanswers its DNS

alt2.aspmx.l.google.comalt1.aspmx.l.google.comaspmx2.googlemail.comaspmx3.googlemail.com+1 more

Google Workspacereceives its email

TLS

virustotal.com

Google Trust Servicesissued its certificate

DNS Records

A 4

216.239.38.21
216.239.36.21
216.239.34.21
216.239.32.21

AAAA 4

2001:4860:4802:38::15
2001:4860:4802:34::15
2001:4860:4802:32::15
2001:4860:4802:36::15

MX 5

20alt2.aspmx.l.google.com
20alt1.aspmx.l.google.com
30aspmx2.googlemail.com
30aspmx3.googlemail.com
10aspmx.l.google.com

TXT 5

v=spf1 include:_spf.google.com include:_spf.zdsys.com include:mail.zendesk.com include:2567647.spf07.hubspotemail.net -all
google-site-verification=i9iYxFW3ir0lIkCTNewpXhSOTBckiAO0H656epZ3HtQ
google-site-verification=tQE2QW2ylRY5dnzKcEisvI9I0h1KA73FJjROvPii1Pk
google-site-verification=Qq9eZi7f40MwYOcrV5vdApFIaFm4aneacq0Lzrcnugg
v=DMARC1; p=quarantine; sp=quarantine; rua=mailto:mailauth-reports@google.com

NS 4

ns-cloud-c4.googledomains.com
ns-cloud-c2.googledomains.com
ns-cloud-c3.googledomains.com
ns-cloud-c1.googledomains.com

SOA 1

ns-cloud-c1.googledomains.com cloud-dns-hostmaster.google.com

SRV 4

talk2.l.google.com:5222 p20
talk1.l.google.com:5222 p20
talk.l.google.com:5222 p5
xmpp-server.l.google.com:5269 p5

CAA 4

issue "letsencrypt.org"
issue "pki.goog"
issue "digicert.com"
issue "sectigo.com"

TLS Certificates (3)

Common Name	Issuer	Expires
`virustotal.com`	C=US, O=Google Trust Services, CN=WR3	Tue, 22 Sep 2026 08:21:09 +0000
`WR3`	C=US, O=Google Trust Services LLC, CN=GTS Root R1	Tue, 20 Feb 2029 14:00:00 +0000
`GTS Root R1`	C=BE, O=GlobalSign nv-sa, 2.5.4.11=Root CA, CN=GlobalSign Root CA	Fri, 28 Jan 2028 00:00:42 +0000

Subdomains (0)

None observed.

The proof

Signed at scan time. Check the math yourself. Every line above is part of one signed observation. Re-hash it and check the Ed25519 signature in your own browser; nothing leaves your machine.

Verify this receipt

Put the receipt on your own site. A live badge showing what DomainDrift observes and signs for virustotal.com. It updates itself. It attests a signed observation - not that the site is safe.

<a href="https://domaindrift.io/t/virustotal.com">
  <img src="https://domaindrift.io/badge/virustotal.com.svg"
       width="300" height="64" alt="DomainDrift signed observations for virustotal.com">
</a>

Ed25519 Receipt

Receipt ID: rcpt_d9ed3e7ba788f85b
Output Hash: 5d35c2c4cbfcfdd9a18e44aaa659f982b80cbd4713fff9d4d5d9cbc7e1e7bf50
Signature: ed25519:e928c6e7d7ae3e65684bdf6276193fdd5746832428728512a309335b959c0fae06ed0d613b63ceb38b15cbc15b59f13389cd3ddaa25c26b8ef7c9071c0772204
Public Key: ed25519:178c3bd0f57d9d64b83cc4630753381e1a465005a2bbba3d032371f24af0bfd8
Parent: (genesis)
Plane: fast

Verify this in your browser

Permalink: https://domaindrift.io/t/virustotal.com